Skip to content

Commit 880ed75

Browse files
denreadenrea
authored
Merge pull request #284412 from cwatson-cat/8-12-24-restore-cef-mapping
Sentinel - Restore CEF name mapping file
2 parents eb5e240 + a0a0ab6 commit 880ed75

File tree

3 files changed

+259
-5
lines changed

3 files changed

+259
-5
lines changed

‎.openpublishing.redirection.sentinel.json

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,5 @@
11
{
22
"redirections": [
3-
{
4-
"source_path": "articles/sentinel/cef-name-mapping.md",
5-
"redirect_url": "/azure/sentinel/cef-syslog-ama-overview",
6-
"redirect_document_id": false
7-
},
83
{
94
"source_path": "articles/sentinel/detect-threats-built-in.md#use-analytics-rule-templates",
105
"redirect_url": "/azure/sentinel/create-analytics-rule-from-template",

‎articles/sentinel/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1303,6 +1303,8 @@
13031303
href: data-source-schema-reference.md
13041304
- name: Security alert schema reference
13051305
href: security-alert-schema.md
1306+
- name: CEF log field mapping
1307+
href: cef-name-mapping.md
13061308
- name: Windows security event sets
13071309
href: windows-security-event-id-reference.md
13081310
- name: DNS over AMA reference

‎articles/sentinel/cef-name-mapping.md

Lines changed: 257 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,257 @@
1+
---
2+
title: Common Event Format (CEF) key and CommonSecurityLog field mapping
3+
description: This article maps CEF keys to the corresponding field names in the CommonSecurityLog in Microsoft Sentinel.
4+
author: yelevin
5+
ms.author: yelevin
6+
ms.topic: reference
7+
ms.date: 08/12/2024
8+
---
9+
10+
# CEF and CommonSecurityLog field mapping
11+
12+
The following tables map Common Event Format (CEF) field names to the names they use in Microsoft Sentinel's CommonSecurityLog, and might be helpful when you're working with a CEF data source in Microsoft Sentinel. For more information, see [Ingest syslog and CEF messages to Microsoft Sentinel with the Azure Monitor Agent](connect-cef-syslog-ama.md).
13+
14+
15+
## A - C
16+
17+
|CEF key name |CommonSecurityLog field name |Description |
18+
|---------|---------|---------|
19+
| act | <a name="deviceaction"></a> DeviceAction | The action mentioned in the event. |
20+
| app | ApplicationProtocol | The protocol used in the application, such as HTTP, HTTPS, SSHv2, Telnet, POP, IMPA, IMAPS, and so on. |
21+
| cat | DeviceEventCategory | Represents the category assigned by the originating device. Devices often use their own categorization schema to classify event. For example: `/Monitor/Disk/Read`. |
22+
| cnt | EventCount | A count associated with the event, showing how many times the same event was observed. |
23+
24+
## D
25+
26+
|CEF key name |CommonSecurityLog name |Description |
27+
|---------|---------|---------|
28+
|Device Vendor | DeviceVendor | String that, together with device product and version definitions, uniquely identifies the type of sending device. |
29+
|Device Product | DeviceProduct | String that, together with device vendor and version definitions, uniquely identifies the type of sending device. |
30+
|Device Version | DeviceVersion | String that, together with device product and vendor definitions, uniquely identifies the type of sending device. |
31+
| destinationDnsDomain | DestinationDnsDomain | The DNS part of the fully qualified domain name (FQDN). |
32+
| destinationServiceName | DestinationServiceName | The service that is targeted by the event. For example, `sshd`.|
33+
| destinationTranslatedAddress | DestinationTranslatedAddress | Identifies the translated destination referred to by the event in an IP network, as an IPv4 IP address. |
34+
| destinationTranslatedPort | DestinationTranslatedPort | Port, after translation, such as a firewall. <br>Valid port numbers: `0` - `65535` |
35+
| deviceDirection | <a name="communicationdirection"></a> CommunicationDirection | Any information about the direction the observed communication has taken. Valid values: <br>- `0` = Inbound <br>- `1` = Outbound |
36+
| deviceDnsDomain | DeviceDnsDomain | The DNS domain part of the full qualified domain name (FQDN) |
37+
|DeviceEventClassID | DeviceEventClassID | String or integer that serves as a unique identifier per event type. |
38+
| deviceExternalId | deviceExternalId | A name that uniquely identifies the device generating the event. |
39+
| deviceFacility | DeviceFacility | The facility generating the event.|
40+
| deviceInboundInterface | DeviceInboundInterface |The interface on which the packet or data entered the device. |
41+
| deviceNtDomain | DeviceNtDomain | The Windows domain of the device address |
42+
| deviceOutboundInterface | DeviceOutboundInterface |Interface on which the packet or data left the device. |
43+
| devicePayloadId |DevicePayloadId |Unique identifier for the payload associated with the event. |
44+
| deviceProcessName | ProcessName | Process name associated with the event. <br><br>For example, in UNIX, the process generating the syslog entry. |
45+
| deviceTranslatedAddress | DeviceTranslatedAddress | Identifies the translated device address that the event refers to, in an IP network. <br><br>The format is an Ipv4 address. |
46+
| dhost |DestinationHostName | The destination that the event refers to in an IP network. <br>The format should be an FQDN associated with the destination node, when a node is available. For example, `host.domain.com` or `host`. |
47+
| dmac | DestinationMacAddress | The destination MAC address (FQDN) |
48+
| dntdom | DestinationNTDomain | The Windows domain name of the destination address.|
49+
| dpid | DestinationProcessId |The ID of the destination process associated with the event.|
50+
| dpriv | DestinationUserPrivileges | Defines the destination use's privileges. <br>Valid values: `Admninistrator`, `User`, `Guest` |
51+
| dproc | DestinationProcessName | The name of the event’s destination process, such as `telnetd` or `sshd.` |
52+
| dpt | DestinationPort | Destination port. <br>Valid values: `*0` - `65535` |
53+
| dst | DestinationIP | The destination IpV4 address that the event refers to in an IP network. |
54+
| dtz | DeviceTimeZone | Timezone of the device generating the event |
55+
| duid |DestinationUserId | Identifies the destination user by ID. |
56+
| duser | DestinationUserName |Identifies the destination user by name.|
57+
| dvc | DeviceAddress | The IPv4 address of the device generating the event. |
58+
| dvchost | DeviceName | The FQDN associated with the device node, when a node is available. For example, `host.domain.com` or `host`.|
59+
| dvcmac | DeviceMacAddress | The MAC address of the device generating the event. |
60+
| dvcpid | Process ID | Defines the ID of the process on the device generating the event. |
61+
62+
## E - I
63+
64+
|CEF key name |CommonSecurityLog name |Description |
65+
|---------|---------|---------|
66+
|externalId | ExternalID | An ID used by the originating device. Typically, these values have increasing values that are each associated with an event. |
67+
|fileCreateTime | FileCreateTime | Time when the file was created. |
68+
|fileHash | FileHash | Hash of a file. |
69+
|fileId | FileID |An ID associated with a file, such as the inode. |
70+
| fileModificationTime | FileModificationTime |Time when the file was last modified. |
71+
| filePath | FilePath | Full path to the file, including the filename. For example: `C:\ProgramFiles\WindowsNT\Accessories\wordpad.exe` or `/usr/bin/zip`.|
72+
| filePermission |FilePermission |The file's permissions. |
73+
| fileType | FileType | File type, such as pipe, socket, and so on.|
74+
|fname | FileName| The file's name, without the path. |
75+
| fsize | FileSize | The size of the file. |
76+
|Host | Computer | Host, from Syslog |
77+
|in | ReceivedBytes |Number of bytes transferred inbound. |
78+
79+
80+
## M - P
81+
82+
|CEF key name |CommonSecurityLog name |Description |
83+
|---------|---------|---------|
84+
|msg | Message | A message that gives more details about the event. |
85+
|Name | Activity | A string that represents a human-readable and understandable description of the event. |
86+
|oldFileCreateTime | OldFileCreateTime | Time when the old file was created. |
87+
|oldFileHash | OldFileHash | Hash of the old file. |
88+
|oldFileId | OldFileId | And ID associated with the old file, such as the inode. |
89+
| oldFileModificationTime | OldFileModificationTime |Time when the old file was last modified. |
90+
| oldFileName | OldFileName |Name of the old file. |
91+
| oldFilePath | OldFilePath | Full path to the old file, including the filename. <br>For example, `C:\ProgramFiles\WindowsNT\Accessories\wordpad.exe` or `/usr/bin/zip`.|
92+
| oldFilePermission | OldFilePermission |Permissions of the old file. |
93+
|oldFileSize | OldFileSize | Size of the old file.|
94+
| oldFileType | OldFileType | File type of the old file, such as a pipe, socket, and so on.|
95+
| out | SentBytes | Number of bytes transferred outbound. |
96+
| outcome | EventOutcome | Outcome of the event, such as `success` or `failure`.|
97+
|proto | Protocol | Transport protocol that identifies the Layer-4 protocol used. <br><br>Possible values include protocol names, such as `TCP` or `UDP`. |
98+
99+
100+
## R - T
101+
102+
|CEF key name |CommonSecurityLog name |Description |
103+
|---------|---------|---------|
104+
| reason | Reason | The reason an audit event was generated. For example, `badd password` or `unknown user`. This could also be an error or return code. For example: `0x1234`. |
105+
|Request | RequestURL | The URL accessed for an HTTP request, including the protocol. For example, `http://www/secure.com` |
106+
|requestClientApplication | RequestClientApplication | The user agent associated with the request. |
107+
| requestContext | RequestContext | Describes the content from which the request originated, such as the HTTP Referrer. |
108+
| requestCookies | RequestCookies |Cookies associated with the request. |
109+
| requestMethod | RequestMethod | The method used to access a URL. <br><br>Valid values include methods such as `POST`, `GET`, and so on. |
110+
| rt | ReceiptTime | The time at which the event related to the activity was received. |
111+
|Severity | <a name="logseverity"></a> LogSeverity | A string or integer that describes the importance of the event.<br><br> Valid string values: `Unknown` , `Low`, `Medium`, `High`, `Very-High` <br><br>Valid integer values are:<br> - `0`-`3` = Low <br>- `4`-`6` = Medium<br>- `7`-`8` = High<br>- `9`-`10` = Very-High |
112+
| shost | SourceHostName |Identifies the source that event refers to in an IP network. Format should be a fully qualified domain name (DQDN) associated with the source node, when a node is available. For example, `host` or `host.domain.com`. |
113+
| smac | SourceMacAddress | Source MAC address. |
114+
| sntdom | SourceNTDomain | The Windows domain name for the source address. |
115+
| sourceDnsDomain | SourceDnsDomain | The DNS domain part of the complete FQDN. |
116+
| sourceServiceName | SourceServiceName | The service responsible for generating the event. |
117+
| sourceTranslatedAddress | SourceTranslatedAddress | Identifies the translated source that the event refers to in an IP network. |
118+
| sourceTranslatedPort | SourceTranslatedPort | Source port after translation, such as a firewall. <br>Valid port numbers are `0` - `65535`. |
119+
| spid | SourceProcessId | The ID of the source process associated with the event.|
120+
| spriv | SourceUserPrivileges | The source user's privileges. <br><br>Valid values include: `Administrator`, `User`, `Guest` |
121+
| sproc | SourceProcessName | The name of the event's source process.|
122+
| spt | SourcePort | The source port number. <br>Valid port numbers are `0` - `65535`. |
123+
| src | SourceIP |The source that an event refers to in an IP network, as an IPv4 address. |
124+
| suid | SourceUserID | Identifies the source user by ID. |
125+
| suser | SourceUserName | Identifies the source user by name. |
126+
| type | EventType | Event type. Value values include: <br>- `0`: base event <br>- `1`: aggregated <br>- `2`: correlation event <br>- `3`: action event <br><br>**Note**: This event can be omitted for base events. |
127+
128+
129+
## Custom fields
130+
131+
The following tables map the names of CEF keys and CommonSecurityLog fields that are available for customers to use for data that doesn't apply to any of the built-in fields.
132+
133+
### Custom IPv6 address fields
134+
135+
The following table maps CEF key and CommonSecurityLog names for the *IPv6* address fields available for custom data.
136+
137+
|CEF key name |CommonSecurityLog name |
138+
|---------|---------|
139+
| c6a1 | DeviceCustomIPv6Address1 |
140+
| c6a1Label | DeviceCustomIPv6Address1Label |
141+
| c6a2 | DeviceCustomIPv6Address2 |
142+
| c6a2Label | DeviceCustomIPv6Address2Label |
143+
| c6a3 | DeviceCustomIPv6Address3 |
144+
| c6a3Label | DeviceCustomIPv6Address3Label |
145+
| c6a4 | DeviceCustomIPv6Address4 |
146+
| c6a4Label | DeviceCustomIPv6Address4Label |
147+
| cfp1 | DeviceCustomFloatingPoint1 |
148+
| cfp1Label | deviceCustomFloatingPoint1Label |
149+
| cfp2 | DeviceCustomFloatingPoint2 |
150+
| cfp2Label | deviceCustomFloatingPoint2Label |
151+
| cfp3 | DeviceCustomFloatingPoint3 |
152+
| cfp3Label | deviceCustomFloatingPoint3Label |
153+
| cfp4 | DeviceCustomFloatingPoint4 |
154+
| cfp4Label | deviceCustomFloatingPoint4Label |
155+
156+
157+
### Custom number fields
158+
159+
The following table maps CEF key and CommonSecurityLog names for the *number* fields available for custom data.
160+
161+
|CEF key name |CommonSecurityLog name |
162+
|---------|---------|
163+
| cn1 | DeviceCustomNumber1 |
164+
| cn1Label | DeviceCustomNumber1Label |
165+
| cn2 | DeviceCustomNumber2 |
166+
| cn2Label | DeviceCustomNumber2Label |
167+
| cn3 | DeviceCustomNumber3 |
168+
| cn3Label | DeviceCustomNumber3Label |
169+
170+
171+
### Custom string fields
172+
173+
The following table maps CEF key and CommonSecurityLog names for the *string* fields available for custom data.
174+
175+
|CEF key name |CommonSecurityLog name |
176+
|---------|---------|
177+
| cs1 | DeviceCustomString1 <sup>[1](#use-sparingly)</sup> |
178+
| cs1Label | DeviceCustomString1Label <sup>[1](#use-sparingly)</sup> |
179+
| cs2 | DeviceCustomString2 <sup>[1](#use-sparingly)</sup> |
180+
| cs2Label | DeviceCustomString2Label <sup>[1](#use-sparingly)</sup> |
181+
| cs3 | DeviceCustomString3 <sup>[1](#use-sparingly)</sup> |
182+
| cs3Label | DeviceCustomString3Label <sup>[1](#use-sparingly)</sup> |
183+
| cs4 | DeviceCustomString4 <sup>[1](#use-sparingly)</sup> |
184+
| cs4Label | DeviceCustomString4Label <sup>[1](#use-sparingly)</sup> |
185+
| cs5 | DeviceCustomString5 <sup>[1](#use-sparingly)</sup> |
186+
| cs5Label | DeviceCustomString5Label <sup>[1](#use-sparingly)</sup> |
187+
| cs6 | DeviceCustomString6 <sup>[1](#use-sparingly)</sup> |
188+
| cs6Label | DeviceCustomString6Label <sup>[1](#use-sparingly)</sup> |
189+
| flexString1 | FlexString1 |
190+
| flexString1Label | FlexString1Label |
191+
| flexString2 | FlexString2 |
192+
| flexString2Label | FlexString2Label |
193+
194+
195+
> [!TIP]
196+
> <a name="use-sparingly"></a><sup>1</sup> We recommend that you use the **DeviceCustomString** fields sparingly and use more specific, built-in fields when possible.
197+
>
198+
### Custom timestamp fields
199+
200+
The following table maps CEF key and CommonSecurityLog names for the *timestamp* fields available for custom data.
201+
202+
|CEF key name |CommonSecurityLog name |
203+
|---------|---------|
204+
| deviceCustomDate1 | DeviceCustomDate1 |
205+
| deviceCustomDate1Label | DeviceCustomDate1Label |
206+
| deviceCustomDate2 | DeviceCustomDate2 |
207+
| deviceCustomDate2Label | DeviceCustomDate2Label |
208+
| flexDate1 | FlexDate1 |
209+
| flexDate1Label | FlexDate1Label |
210+
211+
212+
### Custom integer data fields
213+
214+
The following table maps CEF key and CommonSecurityLog names for the *integer* fields available for custom data.
215+
216+
|CEF key name |CommonSecurityLog name |
217+
|---------|---------|
218+
| flexNumber1 | FlexNumber1 |
219+
| flexNumber1Label | FlexNumber1Label |
220+
| flexNumber2 | FlexNumber2 |
221+
| flexNumber2Label | FlexNumber2Label |
222+
223+
224+
## Enrichment fields
225+
226+
The following **CommonSecurityLog** fields are added by Microsoft Sentinel to enrich the original events received from the source devices, and don't have mappings in CEF keys:
227+
228+
### Threat intelligence fields
229+
230+
|CommonSecurityLog field name |Description |
231+
|---------|---------|
232+
| **IndicatorThreatType** | The [MaliciousIP](#MaliciousIP) threat type, according to the threat intelligence feed. |
233+
| <a name="MaliciousIP"></a>**MaliciousIP** | Lists any IP addresses in the message that correlates with the current threat intelligence feed. |
234+
| **MaliciousIPCountry** | The [MaliciousIP](#MaliciousIP) country/region, according to the geographic information at the time of the record ingestion. |
235+
| **MaliciousIPLatitude** | The [MaliciousIP](#MaliciousIP) longitude, according to the geographic information at the time of the record ingestion. |
236+
| **MaliciousIPLongitude** | The [MaliciousIP](#MaliciousIP) longitude, according to the geographic information at the time of the record ingestion. |
237+
| **ReportReferenceLink** | Link to the threat intelligence report. |
238+
| **ThreatConfidence** | The [MaliciousIP](#MaliciousIP) threat confidence, according to the threat intelligence feed. |
239+
| **ThreatDescription** | The [MaliciousIP](#MaliciousIP) threat description, according to the threat intelligence feed. |
240+
| **ThreatSeverity** | The threat severity for the [MaliciousIP](#MaliciousIP), according to the threat intelligence feed at the time of the record ingestion. |
241+
242+
243+
### Other enrichment fields
244+
245+
|CommonSecurityLog field name |Description |
246+
|---------|---------|
247+
|**OriginalLogSeverity** | Always empty, supported for integration with CiscoASA. <br>For details about log severity values, see the [LogSeverity](#logseverity) field. |
248+
|**RemoteIP** | The remote IP address. <br>This value is based on [CommunicationDirection](#communicationdirection) field, if possible. |
249+
|**RemotePort** | The remote port. <br>This value is based on [CommunicationDirection](#communicationdirection) field, if possible. |
250+
|**SimplifiedDeviceAction** | Simplifies the [DeviceAction](#deviceaction) value to a static set of values, while keeping the original value in the [DeviceAction](#deviceaction) field. <br>For example: `Denied` > `Deny`. |
251+
|**SourceSystem** | Always defined as **OpsManager**. |
252+
253+
254+
## Related content
255+
256+
- [Ingest syslog and CEF messages to Microsoft Sentinel with the Azure Monitor Agent](connect-cef-syslog-ama.md)
257+
- [CommonSecurityLog](/azure/azure-monitor/reference/tables/commonsecuritylog)

0 commit comments

Comments
 (0)